Add Field In Alter Plugin Not Showing values inside field instead showing field name

Hi have created the following code using Alter plugin because the mutate plugin won't work in my logstash server.

filter {
 date{match => ["REQUEST_TIMESTAMP","yyyy-MM-dd HH:mm:ss"]}
  alter {
      add_field => { "[location1][lat]" => "%%{[A_LATITUDE]}" }
      add_field => { "[location1][lon]" => "%%{[A_LONGITUDE]}" }

Using the above code, instead of getting the the Lat and Lon values in the field location1, I am getting the following in the logstash output,

"location1" => {
    "lat" => "%%{[A_LATITUDE]}",
    "lon" => "%%{[A_LONGITUDE]}"

What am I doing wrong in the filter plugin?

A sprintf reference should use a single %. So that should be "%{[A_LATITUDE]}"

Yes @Badger, I tried that too, still the same.

Also getting this error,

"reason"=>"failed to parse field [location1] of type 
[geo_point]", "caused_by"=>{"type"=>"parse_exception", 
"reason"=>"[lat] and [lon] must be valid double values", 
"reason"=>"For input string: \"%{[A LONGITUDE]}\""}}}}}}

That would suggest the source field does not exist.

@Badger what does that mean?

A view of Logstash:

You are trying to reference the value of a field called A_LONGITUDE, but that field does not exist.

@Badger, But it is present :worried:


Is it possible you are referencing it before it is created?

@Badger I am creating a PUT mapping in Kibana dev tools as follows,

PUT test-connectivity-ebond
"mappings": {
"properties": {
    "type": "geo_point"
    "type": "geo_point"

Then coming to Logstash,

filter {

   alter {
      add_field => { "[location1][lat]" => "%{[A_LATITUDE]}" }
      add_field => { "[location1][lon]" => "%{[A_LONGITUDE]}" }

     add_field => { "[location2][lat]" => "%{[B_LATITUDE]}" }
     add_field => { "[location2][lon]" => "%{[B_LONGITUDE]}" }

   date {
   match => [ "REQUEST_TIMESTAMP", "yyyy-MM-dd HH:mm:ss" ]


How does the [A_LONGITUDE] field get created?

@Badger, it is a column from the database.

@Badger, so I have Lat and Lon values in two separate columns called A_LATITUDE and A_LONGITUDE similarly two other columns called B_LATITUDE and B_LONGITUDE.

I cannot explain that.

@Badger, got it solved using the Mutate Filter Plugin! Thank you :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.